Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
2answers
82 views

Is it necessary to use esc_url with template tags such as get_permalink?

I have been reading that sanitizing data output is important in theme / plugin development for wordpress. Is it necessary to use functions such as esc_url with template tags like get_permalink, or ...
4
votes
1answer
105 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
0
votes
2answers
29 views

Is there a way to remove the option to modify the Slug in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
4
votes
1answer
116 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
-1
votes
2answers
1k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
1
vote
0answers
49 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
0answers
31 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
1
vote
2answers
26 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
2
votes
1answer
99 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
0
votes
2answers
294 views

How can I password protect a WordPress site without requiring users to log in?

I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
1
vote
1answer
137 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
0
votes
0answers
58 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
2
votes
1answer
96 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
0
votes
1answer
89 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
0answers
39 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
2
votes
0answers
18 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
1
vote
1answer
835 views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
0
votes
0answers
28 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
2answers
45 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
2
votes
1answer
95 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in ...
4
votes
1answer
83 views

What are the security reasons to disallow Microsoft Word uploads?

When I try uploading a .doc or .docx file I get this message: Sorry, this file type is not permitted for security reasons What are the security risks involved in a multisite installation ...
19
votes
2answers
12k views

How to Protect Uploads, if User is not Logged In?

I use wordpress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in. I would like to do the same to the files ...
2
votes
0answers
318 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
0
votes
1answer
16 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
2
votes
3answers
7k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
31
votes
10answers
21k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
0
votes
1answer
105 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
0answers
25 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
2answers
634 views

How to rewrite rules for WP-security in Nginx?

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I ...
0
votes
0answers
111 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
174 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
0
votes
0answers
112 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
1answer
82 views

Session Cookie security questions

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company. My company recently spent a ...
0
votes
1answer
31 views

wordpress admin security

I scan my website using different tool but it shows no malicious script. But when i see in admin dashboard i see strange symbol square below body tag. i tried to check admin index file,root index ...
1
vote
0answers
33 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
0
votes
1answer
36 views

404 errors in log showing urls with 'GET', plus and numerical code

My wordpress logs show 404 errors to URLs having the following pattern: http://example.com/path/++GET+http:/example/+0,48595,73506+- Web searches do not return answers because of the plus and minus ...
5
votes
5answers
3k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
0
votes
0answers
111 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
1
vote
0answers
42 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
3
votes
3answers
142 views

How to Block Access to Standard Login Flow and Comment Flow

I've set up custom flows on my Wordpress blog for login, signup, and commenting. I would like to password protect the standard login flow so only I can use it, and block access entirely to the ...
1
vote
1answer
38 views

Restrict custom post type from appearing with ?post_types=

When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have ...
0
votes
2answers
24 views

Regarding plugin security

Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them? If so, what would be the best way to do ...
14
votes
6answers
437 views

Are Wordpress Plugins essential?

I'm new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at ...
2
votes
1answer
723 views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
0
votes
2answers
86 views

Config file with no Keys..?

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is ...
2
votes
1answer
387 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
1answer
56 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
0
votes
1answer
153 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
2
votes
1answer
201 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
10
votes
1answer
167 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...